mirror of
https://github.com/SebastianWendel/nixpkgs.git
synced 2024-09-20 04:19:00 +02:00
nixos/stub-ld: init module
This commit is contained in:
parent
bf6f0d3cf4
commit
0863f6d2da
|
@ -10,6 +10,10 @@ In addition to numerous new and upgraded packages, this release has the followin
|
||||||
|
|
||||||
- `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
|
- `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
|
||||||
|
|
||||||
|
- NixOS now installs a stub ELF loader that prints an informative error message when users attempt to run binaries not made for NixOS.
|
||||||
|
- This can be disabled through the `environment.stub-ld.enable` option.
|
||||||
|
- If you use `programs.nix-ld.enable`, no changes are needed. The stub will be disabled automatically.
|
||||||
|
|
||||||
## New Services {#sec-release-24.05-new-services}
|
## New Services {#sec-release-24.05-new-services}
|
||||||
|
|
||||||
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
|
||||||
|
|
56
nixos/modules/config/stub-ld.nix
Normal file
56
nixos/modules/config/stub-ld.nix
Normal file
|
@ -0,0 +1,56 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) optionalString mkOption types mdDoc mkIf mkDefault;
|
||||||
|
|
||||||
|
cfg = config.environment.stub-ld;
|
||||||
|
|
||||||
|
message = ''
|
||||||
|
NixOS cannot run dynamically linked executables intended for generic
|
||||||
|
linux environments out of the box. For more information, see:
|
||||||
|
https://nix.dev/permalink/stub-ld
|
||||||
|
'';
|
||||||
|
|
||||||
|
stub-ld-for = pkgsArg: messageArg: pkgsArg.pkgsStatic.runCommandCC "stub-ld" {
|
||||||
|
nativeBuildInputs = [ pkgsArg.unixtools.xxd ];
|
||||||
|
inherit messageArg;
|
||||||
|
} ''
|
||||||
|
printf "%s" "$messageArg" | xxd -i -n message >main.c
|
||||||
|
cat <<EOF >>main.c
|
||||||
|
#include <stdio.h>
|
||||||
|
int main(int argc, char * argv[]) {
|
||||||
|
fprintf(stderr, "Could not start dynamically linked executable: %s\n", argv[0]);
|
||||||
|
fwrite(message, sizeof(unsigned char), message_len, stderr);
|
||||||
|
return 127; // matches behavior of bash and zsh without a loader. fish uses 139
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
$CC -Os main.c -o $out
|
||||||
|
'';
|
||||||
|
|
||||||
|
pkgs32 = pkgs.pkgsi686Linux;
|
||||||
|
|
||||||
|
stub-ld = stub-ld-for pkgs message;
|
||||||
|
stub-ld32 = stub-ld-for pkgs32 message;
|
||||||
|
in {
|
||||||
|
options = {
|
||||||
|
environment.stub-ld = {
|
||||||
|
enable = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = true;
|
||||||
|
example = false;
|
||||||
|
description = mdDoc ''
|
||||||
|
Install a stub ELF loader to print an informative error message
|
||||||
|
in the event that a user attempts to run an ELF binary not
|
||||||
|
compiled for NixOS.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
environment.ldso = mkDefault stub-ld;
|
||||||
|
environment.ldso32 = mkIf pkgs.stdenv.isx86_64 (mkDefault stub-ld32);
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = with lib.maintainers; [ tejing ];
|
||||||
|
}
|
|
@ -29,6 +29,7 @@
|
||||||
./config/resolvconf.nix
|
./config/resolvconf.nix
|
||||||
./config/shells-environment.nix
|
./config/shells-environment.nix
|
||||||
./config/stevenblack.nix
|
./config/stevenblack.nix
|
||||||
|
./config/stub-ld.nix
|
||||||
./config/swap.nix
|
./config/swap.nix
|
||||||
./config/sysctl.nix
|
./config/sysctl.nix
|
||||||
./config/system-environment.nix
|
./config/system-environment.nix
|
||||||
|
|
|
@ -21,6 +21,8 @@ with lib;
|
||||||
# Perl is a default package.
|
# Perl is a default package.
|
||||||
environment.defaultPackages = mkDefault [ ];
|
environment.defaultPackages = mkDefault [ ];
|
||||||
|
|
||||||
|
environment.stub-ld.enable = false;
|
||||||
|
|
||||||
# The lessopen package pulls in Perl.
|
# The lessopen package pulls in Perl.
|
||||||
programs.less.lessopen = mkDefault null;
|
programs.less.lessopen = mkDefault null;
|
||||||
|
|
||||||
|
|
|
@ -787,6 +787,7 @@ in {
|
||||||
step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
|
step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
|
||||||
stratis = handleTest ./stratis {};
|
stratis = handleTest ./stratis {};
|
||||||
strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
|
strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
|
||||||
|
stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix {};
|
||||||
stunnel = handleTest ./stunnel.nix {};
|
stunnel = handleTest ./stunnel.nix {};
|
||||||
sudo = handleTest ./sudo.nix {};
|
sudo = handleTest ./sudo.nix {};
|
||||||
sudo-rs = handleTest ./sudo-rs.nix {};
|
sudo-rs = handleTest ./sudo-rs.nix {};
|
||||||
|
|
73
nixos/tests/stub-ld.nix
Normal file
73
nixos/tests/stub-ld.nix
Normal file
|
@ -0,0 +1,73 @@
|
||||||
|
import ./make-test-python.nix ({ lib, pkgs, ... }: {
|
||||||
|
name = "stub-ld";
|
||||||
|
|
||||||
|
nodes.machine = { lib, ... }:
|
||||||
|
{
|
||||||
|
environment.stub-ld.enable = true;
|
||||||
|
|
||||||
|
specialisation.nostub = {
|
||||||
|
inheritParentConfig = true;
|
||||||
|
|
||||||
|
configuration = { ... }: {
|
||||||
|
environment.stub-ld.enable = lib.mkForce false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = let
|
||||||
|
libDir = pkgs.stdenv.hostPlatform.libDir;
|
||||||
|
ldsoBasename = lib.last (lib.splitString "/" pkgs.stdenv.cc.bintools.dynamicLinker);
|
||||||
|
|
||||||
|
check32 = pkgs.stdenv.isx86_64;
|
||||||
|
pkgs32 = pkgs.pkgsi686Linux;
|
||||||
|
|
||||||
|
libDir32 = pkgs32.stdenv.hostPlatform.libDir;
|
||||||
|
ldsoBasename32 = lib.last (lib.splitString "/" pkgs32.stdenv.cc.bintools.dynamicLinker);
|
||||||
|
|
||||||
|
test-exec = builtins.mapAttrs (n: v: pkgs.runCommand "test-exec-${n}" { src = pkgs.fetchurl v; } "mkdir -p $out;cd $out;tar -xzf $src") {
|
||||||
|
x86_64-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-x86_64-unknown-linux-gnu.tar.gz";
|
||||||
|
x86_64-linux.hash = "sha256-3zySzx8MKFprMOi++yr2ZGASE0aRfXHQuG3SN+kWUCI=";
|
||||||
|
i686-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-i686-unknown-linux-gnu.tar.gz";
|
||||||
|
i686-linux.hash = "sha256-fWNiATFeg0B2pfB5zndlnzGn7Ztl8diVS1rFLEDnSLU=";
|
||||||
|
aarch64-linux.url = "https://github.com/rustic-rs/rustic/releases/download/v0.6.1/rustic-v0.6.1-aarch64-unknown-linux-gnu.tar.gz";
|
||||||
|
aarch64-linux.hash = "sha256-hnldbd2cctQIAhIKoEZLIWY8H3jiFBClkNy2UlyyvAs=";
|
||||||
|
};
|
||||||
|
exec-name = "rustic";
|
||||||
|
|
||||||
|
if32 = pythonStatement: if check32 then pythonStatement else "pass";
|
||||||
|
in
|
||||||
|
''
|
||||||
|
machine.start()
|
||||||
|
machine.wait_for_unit("multi-user.target")
|
||||||
|
|
||||||
|
with subtest("Check for stub (enabled, initial)"):
|
||||||
|
machine.succeed('test -L /${libDir}/${ldsoBasename}')
|
||||||
|
${if32 "machine.succeed('test -L /${libDir32}/${ldsoBasename32}')"}
|
||||||
|
|
||||||
|
with subtest("Try FHS executable"):
|
||||||
|
machine.copy_from_host('${test-exec.${pkgs.system}}','test-exec')
|
||||||
|
machine.succeed('if test-exec/${exec-name} 2>outfile; then false; else [ $? -eq 127 ];fi')
|
||||||
|
machine.succeed('grep -qi nixos outfile')
|
||||||
|
${if32 "machine.copy_from_host('${test-exec.${pkgs32.system}}','test-exec32')"}
|
||||||
|
${if32 "machine.succeed('if test-exec32/${exec-name} 2>outfile32; then false; else [ $? -eq 127 ];fi')"}
|
||||||
|
${if32 "machine.succeed('grep -qi nixos outfile32')"}
|
||||||
|
|
||||||
|
with subtest("Disable stub"):
|
||||||
|
machine.succeed("/run/booted-system/specialisation/nostub/bin/switch-to-configuration test")
|
||||||
|
|
||||||
|
with subtest("Check for stub (disabled)"):
|
||||||
|
machine.fail('test -e /${libDir}/${ldsoBasename}')
|
||||||
|
${if32 "machine.fail('test -e /${libDir32}/${ldsoBasename32}')"}
|
||||||
|
|
||||||
|
with subtest("Create file in stub location (to be overwritten)"):
|
||||||
|
machine.succeed('mkdir -p /${libDir};touch /${libDir}/${ldsoBasename}')
|
||||||
|
${if32 "machine.succeed('mkdir -p /${libDir32};touch /${libDir32}/${ldsoBasename32}')"}
|
||||||
|
|
||||||
|
with subtest("Re-enable stub"):
|
||||||
|
machine.succeed("/run/booted-system/bin/switch-to-configuration test")
|
||||||
|
|
||||||
|
with subtest("Check for stub (enabled, final)"):
|
||||||
|
machine.succeed('test -L /${libDir}/${ldsoBasename}')
|
||||||
|
${if32 "machine.succeed('test -L /${libDir32}/${ldsoBasename32}')"}
|
||||||
|
'';
|
||||||
|
})
|
Loading…
Reference in a new issue